MCP server for music playback, web scraping, JavaScript evaluation, and timer management
Server has 6 tools with visible schemas and descriptions, but quality is inconsistent. Tool names lack clear action verbs (find_music vs search_music, play_music vs start_playback). Descriptions are present but often vague or in Russian, making LLM selection difficult. Parameter descriptions exist but lack constraints (enums, ranges, formats). Critical security issue: eval_js exposes arbitrary code execution without safeguards. Error handling is minimal, most tools return raw error messages without recovery guidance. No output schemas documented. Composition is poor: play_music combines download+queue+play; stop_music has undocumented side effects (clears queue). Average tool score: 38/100.
Выполняет джаваскрипт код через eval. Пример: let worder = 'Hello ' + 'World'; worder; (код вернет Hello World)
Find music by name or artist. Empty query to check local library
Loads and plays audio by URL, id or FILENAME IF FROM LOCAL LIBRARY
Получает текст страницы по определенному адресу
Stops music (AND CLEARS QUEUE)
Set timer
eval_js tool exposes arbitrary JavaScript execution without sandboxing, input validation, or permission gates. Violates security pattern:secret-injection and pattern:permission-gate. LLM could execute destructive code.
play_music combines three concerns: download, queue management, and playback. Should split into separate tools (queue_music, start_playback) so agent can compose independently. Violates pattern:tool.
stop_music description does not document that it clears the queue, a destructive side effect. LLM cannot predict consequences. Violates pattern:command-tool.
read_web_page description is in Russian ('Получает текст страницы по определенному адресу'). LLMs trained on English struggle with non-English descriptions. Descriptions should be in English for maximum compatibility.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to guess field names for downstream calls. Violates pattern:tool.